Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.
France’s ANSSI said the cyberattack that disrupted supermarket refrigeration this week also compromised Copeland XWEB and Dixell XWEB controllers, after first warning about Danfoss AK-SM and AK-SC systems. Finance Minister Roland Lescure said about 700 of France’s roughly 10,000 supermarkets were affected, including Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix. At some Intermarché stores refrigeration ran at 50 degrees Celsius for six hours and food was discarded; prosecutors said the attack also caused fires. How access was gained is still unclear and has not been linked to flaws Claroty disclosed this summer. CERT-FR urged operators to take the controllers offline, and investigators have reported neither a claim of responsibility nor a ransom demand.
- ANSSI expanded the alert from Danfoss controllers to Copeland and Dixell XWEB systems.
- About 700 French supermarkets were affected; some lost food and fires were reported.
- Entry method is unknown and has not been tied to Claroty’s disclosed flaws.
- Many affected Danfoss units are end-of-life and no longer patched.
- CERT-FR told operators to remove controllers from the internet; no ransom claim is reported.
Full article628 words · extracted from securityweek.com · click to collapse
The cyberattack that disrupted refrigeration at hundreds of French supermarkets this week also affected equipment from Copeland and its Dixell brand, according to France’s national cybersecurity agency ANSSI.
ANSSI’s CERT-FR first warned on October 12 of numerous compromises involving Danfoss AK-SM and AK-SC series refrigeration controllers. A day later, the agency updated its alert to include Copeland XWEB and Dixell XWEB systems.
Copeland initially declined to confirm the agency’s findings, but it has since acknowledged a vulnerability. “We are currently working with impacted customers to mitigate the risk,” the company said.
This summer, Claroty detailed flaws in Danfoss’s AK-SM 800A, along with 23 vulnerabilities in Copeland’s XWEB Pro controller. Copeland patched them in a firmware update.
It is still unclear how the attackers gained access. The CERT-FR alert does not link the compromises to any specific vulnerability, and neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed.
Danfoss said most of the affected devices are older AK-SM 800 and AK-SC 355 systems, which have reached end of life and are no longer patched. The vendor stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers that were running outdated firmware were also affected.
Advertisement. Scroll to continue reading.
CERT-FR has urged operators of the affected controllers to take them off the internet and restore remote access only through a secure VPN or protected network. Filtering connections by IP address is acceptable only as a temporary emergency measure, the agency said.
For compromised end-of-life devices, a factory reset alone is not enough as the device will remain vulnerable and is likely to be compromised again if it stays exposed.
Hundreds of supermarkets affected in France
Supermarket chains that have confirmed being affected include Carrefour, Coopérative U, E.Leclerc, Intermarché, and Monoprix.
About 700 of France’s roughly 10,000 supermarkets were affected, Finance Minister Roland Lescure told lawmakers on Tuesday. Earlier reports had put the number at 300-350.
At Intermarché, about 150 stores were affected, according to owner Les Mousquetaires. Refrigeration units there ran at 50 degrees Celsius for six hours, and all the food was discarded. Carrefour said 80 of its stores were impacted.
Coopérative U CEO Dominique Schelcher said 80 of the group’s stores were targeted, but only a minority had to throw away products. Two supermarkets in Alsace reported combined losses of €270,000 ($300,000).
The Paris prosecutor’s office, whose cybercrime unit has opened an investigation, said the attack caused fires in addition to food losses. According to Le Monde, the attackers lengthened defrost cycles from one hour to as many as eight, which delayed alarms.
Investigators are reportedly puzzled by the lack of either a claim of responsibility or a ransom demand, Reuters reported, citing a source familiar with the probe.
Sekoia’s Félix Aimé told Reuters that stores in Spain, Portugal, Poland, Germany, and Belgium were also affected, but did not provide details. The Dutch NCSC said it did not believe a cyberattack against Ahold Delhaize was connected to the attack on refrigerators.
Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on October 11, more than 1,800 of them in France. By October 14, the French count had dropped to 537, while the number elsewhere barely changed.
Patched and unpatched versions disappeared at roughly the same rate, suggesting that operators are disconnecting the controllers rather than updating them, Censys noted.
The attack has also raised questions about liability. Les Mousquetaires said the refrigeration systems were managed by Danfoss and that it is therefore up to the supplier to file a complaint with the authorities, Bloomberg reported.
Related: CenterPoint Energy Data Breach Impacts 1 Million Texans
Related: Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach